Checking for disabled ad account

Hi I’ve configured EAP-TLS with ocsp validation in FR 3.0.16 I’ve now been told that I need to also check that the username associated with the account hasn’t been disabled in our AD service. Same FR server also does EAP-PEAP auth against AD Any suggestions as to how I might do this ? Rgds Alex Sent from my iPhone 6 plus